This is one of those rare kinds of mistakes where I really believe someone's head should roll. They gave away the privacy of potentially millions of people. It will have real world consequences for some of them.
And playing devil's advocate, sure a thief could steal your phone and use this exploit (if he even knew about it), but what's he going to do with the contact list? If someone steals your iPhone, they did it to wipe it and resell it. There are much, much easier and less risky ways of getting large lists of people's contact info if that's what they're after.
Programmers make mistakes. Saying they should get fired over this is a bit silly, IMO.
EDIT: I'm not trying to downplay the seriousness. It's definitely serious. I've known some people who would use this against their "cheating" girlfriend in a heartbeat to see who they've been calling. But I seriously doubt anywhere close to millions will be affected.
Are you telling me that a sufficiently motivated entity couldn't get to the data stored on the phone? Once you have physical access to a device, things like this kind of become moot anyway, don't they?
I seriously doubt anywhere close to millions will be affected.
And what's "silly" about preventing people from getting immediate access to your email account or text messages? You can get into most people's online bank account once you have their email.